Hancitor Sep 5

https://www.virustotal.com/file/c95a068e72de595a6e9b0c29bdc1745e87f2eb54eedeeb58c0fbf4fad9ce2211/analysis/1504621937/
https://www.threatcrowd.org/ip.php?ip=54.144.51.124
https://packettotal.com/cgi-bin/view-analysis.cgi?id=772af587cb4d066c845be7cd496930e7

doc dl:
http://DOWNETWPNJ.NET/lenta.php?d=
http://proconservicesllc.com/lenta.php?d=
http://turbotville.com/lenta.php?d=

c2:
http://orcateheck.com/ls5/forum.php
http://hedtfortedlet.ru/ls5/forum.php
http://disitofle.ru/ls5/forum.php

dl:
http://crabbiesfruits.com/wp-content/plugins/regenerate-thumbnails/1
http://crabbiesfruits.com/wp-content/plugins/regenerate-thumbnails/2
http://crabbiesfruits.com/wp-content/plugins/regenerate-thumbnails/3

zloader c2:
http://ughneredrob.com/bdl/gate.php
http://rebjusjohed.com/bdl/gate.php